/cloud-native

name: Cloud-Native Security
description: This skill should be used when the user asks about "cloud security", "AWS security", "GCP security", "Azure security", "Kubernetes security", "IMDS", "instance metadata", "S3 bucket policy", "IAM", "serverless security", "Lambda security", "container security", "cloud misconfiguration", "SSRF to cloud metadata", or needs to identify cloud-native security issues during whitebox security review.
version: 1.0.0

Cloud-Native Security Patterns Reference

Purpose

Identify security vulnerabilities specific to cloud-native environments, including IMDS exploitation, cloud provider misconfigurations, Kubernetes security issues, and serverless attack vectors. Cloud-native applications have unique trust boundaries and implicit assumptions that create vulnerability classes not present in traditional deployments.

When to Use

Activate this skill when:

• Reviewing code that interacts with AWS, GCP, or Azure APIs
• Auditing Kubernetes manifests and Helm charts
• Assessing serverless functions (Lambda, Cloud Functions, Azure Functions)
• Evaluating SSRF findings for cloud metadata exploitation
• Reviewing Infrastructure as Code (Terraform, CloudFormation, Pulumi)
• Checking for hardcoded cloud credentials

Instance Metadata Service (IMDS)

Overview

Cloud instances expose a metadata service at a well-known IP address. SSRF vulnerabilities in cloud-hosted applications can be exploited to access this metadata, potentially leaking IAM credentials, instance identity tokens, and configuration data.

IMDS Endpoints

| Provider | IPv4 Endpoint | IPv6 Endpoint | Protocol | |----------|--------------|---------------|----------| | AWS EC2 | `169.254.169.254` | `fd00:ec2::254` | HTTP | | GCP | `metadata.google.internal` (`169.254.169.254`) | N/A | HTTP | | Azure | `169.254.169.254` | N/A | HTTP | | DigitalOcean | `169.254.169.254` | N/A | HTTP | | Oracle Cloud | `169.254.169.254` | N/A | HTTP |

AWS IMDSv1 vs IMDSv2

| Feature | IMDSv1 | IMDSv2 | |---------|--------|--------| | Request method | Simple GET | PUT to get token, then GET with token header | | SSRF exploitable | Yes (single GET request) | Harder (requires PUT + custom header) | | Mitigation | Disable or upgrade | Enforce IMDSv2-only via `HttpTokens: required` |

**IMDSv1 Exploitation** (simple GET):

GET http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>

**IMDSv2 Exploitation** (requires PUT + header):

PUT http://169.254.169.254/latest/api/token
X-aws-ec2-metadata-token-ttl-seconds: 21600

GET http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>
X-aws-ec2-metadata-token: <token>

**Detection Patterns**:

# References to IMDS IP addresses
grep -rniE "169\.254\.169\.254|fd00:ec2::254" --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.java" --include="*.rb" --include="*.php" --include="*.yaml" --include="*.yml" --include="*.tf" --include="*.json"

# GCP metadata endpoint
grep -rniE "metadata\.google\.internal|metadata-flavor.*Google" --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.java"

# Azure metadata
grep -rniE "169\.254\.169\.254.*Metadata.*true|Metadata.*169\.254\.169\.254" --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.java"

# URL fetch libraries that could be SSRF vectors to IMDS
grep -rniE "(requests\.get|urllib|http\.Get|axios|fetch)\s*\(" --include="*.py" --include="*.js" --include="*.ts" --include="*.go"

AWS-Specific Patterns

S3 Bucket Policy Misconfigurations

**Pattern**: S3 bucket policies with overly permissive Principal or Action statements.

# S3 bucket policy with wildcard principal
grep -rniE '"Principal"\s*:\s*"\*"|"Principal"\s*:\s*\{"AWS"\s*:\s*"\*"' --include="*.json" --include="*.tf" --include="*.yaml" --include="*.yml"

# Public ACL settings
grep -rniE "(PublicRead|public-read|public-read-write|authenticated-read)" --include="*.json" --include="*.tf" --include="*.yaml" --include="*.yml"

# S3 bucket creation without encryption
grep -rniE "aws_s3_bucket\b" --include="*.tf" -A 20 | grep -viE "(encryption|sse|kms)"

# Block public access disabled
grep -rniE "(block_public_acls|block_public_policy|ignore_public_acls|restrict_public_buckets)\s*=\s*false" --include="*.tf"

IAM Role Assumption Chains

**Pattern**: Overly permissive `sts:AssumeRole` policies that allow lateral movement or privilege escalation.

# IAM assume role policies
grep -rniE "sts:AssumeRole|sts:AssumeRoleWithWebIdentity|sts:AssumeRoleWithSAML" --include="*.json" --include="*.tf" --include="*.yaml" --include="*.yml"

# Wildcard IAM actions
grep -rniE '"Action"\s*:\s*"\*"|"Action"\s*:\s*\[.*"\*"' --include="*.json" --include="*.tf"

# Overly broad resource patterns
grep -rniE '"Resource"\s*:\s*"\*"' --include="*.json" --include="*.tf"

STS Tokens and Access Keys

# Hardcoded AWS access keys
grep -rniE "AKIA[0-9A-Z]{16}" --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.java" --include="*.env" --include="*.yaml" --include="*.yml" --include="*.tf"

# AWS secret keys (near AWS context)
grep -rniE "(aws_secret_access_key|AWS_SECRET_ACCESS_KEY|SecretAccessKey)\s*[:=]\s*[\"'][0-9a-zA-Z/+]{40}" --include="*.py" --include="*.js" --include="*.ts" --include="*.env" --include="*.yaml"

# STS tokens in environment variables or code
grep -rniE "(AWS_SESSION_TOKEN|aws_session_token|SessionToken)\s*[:=]" --include="*.py" --include="*.js" --include="*.ts" --include="*.env" --include="*.yaml"

# AWS credentials in code (boto3)
grep -rniE "boto3\.(client|resource|Session)\s*\(" --include="*.py" -A 5 | grep -iE "(aws_access_key_id|aws_secret_access_key|aws_session_token)"

AWS SDK Usage Patterns

# Detect AWS SDK usage
grep -rniE "^(import|from)\s+boto3|require\([\"']aws-sdk|@aws-sdk/" --include="*.py" --include="*.js" --include="*.ts"

# S3 ope